MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b0d715629b160faa4043fd685073d6b419d6e1cefc907ba5e6abcf0e3352938. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b0d715629b160faa4043fd685073d6b419d6e1cefc907ba5e6abcf0e3352938
SHA3-384 hash: 2a907d46a5d1addee392db73d58f88747c05c1e31cddc18d01da7560f4ef313e12abf6f7f5a35bebcbaf409172f42d85
SHA1 hash: b6b17b86fe93904825d80aec3a20f90f513a823f
MD5 hash: 995ba127572a8a23c4e2ede80ca91219
humanhash: alaska-nitrogen-double-salami
File name:Asif Javed Resume 01.pdf.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:444'619 bytes
First seen:2020-07-16 06:45:45 UTC
Last seen:2020-07-19 10:56:44 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:M/ESIGWDThpIXYKlKY9NO+i/RROvbfdXRE:IE4Do8KYEXIXRE
TLSH 0B9423636A3058BFE0BE76D4C70791304A1323365C689C73CA73467BE0AA6609B1D7DE
Reporter abuse_ch
Tags:NanoCore zip


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: jmigroup-bd.com
Sending IP: 37.49.230.190
From: Asif Javed <asif.javed.moiz@gmail.com>
Subject: Resume for the post of Sales Executive Islamabad
Attachment: Asif Javed Resume 01.pdf.zip (contains "Asif Javed Resume 01.exe")

NanoCore RAT C2:
harri2gudd.duckdns.org:2177 (105.112.104.62)

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Daqc-6598201-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b0d715629b160faa4043fd685073d6b419d6e1cefc907ba5e6abcf0e3352938/
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 06:47:06 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fmgxcvrjwfqpvjaeh7likbz5nnaz23q457eqpos6nk6pbyzvfe4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip 2b0d715629b160faa4043fd685073d6b419d6e1cefc907ba5e6abcf0e3352938

(this sample)

NanoCore

Executable exe bf690b9b4ab2e0306b94b1a09431878786eb0fd6e858ac1f5d21c29a78b1f8d0

  
Dropping
MD5 6cf658772409aad77bf399877c3ba5ce
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bf690b9b4ab2e0306b94b1a09431878786eb0fd6e858ac1f5d21c29a78b1f8d0

Comments